From ff0e3a6c69f147dd74fc1aac090e8eb232e7adcf Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Wed, 21 Oct 2026 15:06:40 +0200 Subject: [PATCH] docs(19.5): record the last UAT answers (prohibitions, CR-02 wording) --- .../19.5-UAT.md | 14 ++++++++------ .planning/todos/pending/email-proof-release.md | 4 ++-- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md b/.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md index 02027b66..766e9c50 100644 --- a/.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md +++ b/.planning/phases/19.5-social-login-in-sm-user-plugin/19.5-UAT.md @@ -1,9 +1,9 @@ --- -status: testing +status: complete phase: 19.5-social-login-in-sm-user-plugin source: [19.5-VERIFICATION.md] started: 2026-10-21T00:24:54.347Z -updated: 2026-10-21T13:20:00.000Z +updated: 2026-10-21T13:40:00.000Z --- ## Current Test @@ -30,18 +30,20 @@ retested_by: 19.5-05 ### 3. Review the judgment-tier prohibition verdicts in the 'Prohibitions' section of this report (non-authoritative LLM-judge verdicts). expected: Confirm or dispute each verdict; all are recorded as no violation found. -result: [pending] +result: pass +reported: "prohibitions ok" ### 4. Decide on 19.5-REVIEW CR-02: an account pre-created by sociallogin from an unverified provider email (created activated, S classes/registration.go) keeps the attacker's Microsoft or Facebook identity after the real owner proves the address with a reset-code password reset. expected: Either accept it (PHP parity on account creation) and correct sm-sociallogin-plugin README.md:50, which offers 'proves the address with a password reset' as the recovery; or schedule the follow-up the review proposes (create the account inactive unless p.EmailVerified, and/or drop unverified identities when the reset stamps email_verified_at). -result: [pending] +result: pass +reported: "fix README wording quickly" (behaviour accepted; sm-sociallogin-plugin 79cebb9 says a reset does not unlink identities linked before the proof and points to the identities list) ## Summary total: 4 -passed: 1 +passed: 3 issues: 0 -pending: 2 +pending: 0 skipped: 1 blocked: 0 diff --git a/.planning/todos/pending/email-proof-release.md b/.planning/todos/pending/email-proof-release.md index 24eb053d..681f8014 100644 --- a/.planning/todos/pending/email-proof-release.md +++ b/.planning/todos/pending/email-proof-release.md @@ -36,7 +36,7 @@ Unreleased commits (`git log --oneline origin/master..master`, fetched 2026-10-2 | Repository | Unpushed commits | This plan's? | |------------|------------------|--------------| | sm-user-plugin (`../fonoteka.go/plugins/golem15/user`) | `35cf166`, `a99cb46`, `add1f7a` | all 19.5-05 | -| sm-sociallogin-plugin | `c4ebf05`, `962190b`, `3bb5650` | all 19.5-05 | +| sm-sociallogin-plugin | `79cebb9`, `c4ebf05`, `962190b`, `3bb5650` | all 19.5-05 (79cebb9: README, CR-02 wording) | | sm-bm-app | `5fd0cc3` (bm OAuth callback view test) | 19.5-05 Task 4 | | sm-demo-app | `b325460` feat(demo): roadmap deck describes the new console | **foreign**: another session (19.8), touches only `plugins/demo/content/ROADMAP.md` and `plugins/demo/roadmap/` | | fonoteka.go | 31 commits (`f4d5728` … `ca746fc`) | all foreign; fonoteka.go is never pushed by this release | @@ -47,7 +47,7 @@ Proposed tags (free on the remotes at the time of the check; no tag points at ei | Repository | Tag | Points at | |------------|-----|-----------| | sm-user-plugin | `v0.1.5` | `35cf166` | -| sm-sociallogin-plugin | `v0.1.2` | the new commit `chore: require sm-user-plugin v0.1.5` on top of `c4ebf05` | +| sm-sociallogin-plugin | `v0.1.2` | the new commit `chore: require sm-user-plugin v0.1.5` on top of `79cebb9` | Current pins: sm-demo-app and sm-bm-app `plugins/golem15/user` c43ba87 (v0.1.4) and `plugins/golem15/sociallogin` d7ee28d (v0.1.1); sm-demo-app go.mod requires sm-user-plugin v0.1.4 and sm-sociallogin-plugin v0.1.1; sm-bm-app go.mod requires sm-user-plugin v0.1.4 and sm-sociallogin-plugin v0.0.0 (replace to the submodule; only the user line names a version); fonoteka.go gitlink c43ba87, with the worktree already at `35cf166` and left unstaged.